Key points
- Bank of America deployed 4,000 people to address vulnerabilities discovered by AI security models.
- CEO Brian Moynihan stated the bank spent hundreds of millions in the third quarter on this work and AML requirements.
- The effort involves 1,000 external contractors working alongside 3,000 internal employees since the second quarter.
Bank of America has mobilised a workforce of 4,000 personnel to address software vulnerabilities identified by artificial intelligence models. The initiative includes 1,000 external contractors and 3,000 internal staff who have been collaborating since the second quarter.
What happened
Bank of America CEO Brian Moynihan confirmed the scale of the remediation effort, noting that the bank engaged 1,000 outside contractors to assist with the patching work. These external experts have been operating alongside 3,000 internal employees since the second quarter of the year. The focus is on fixing software vulnerabilities uncovered by AI models, including Anthropic's Mythos.
The financial institution disclosed spending of a few hundred million dollars during the third quarter. This expenditure covers both the software remediation activities and compliance with anti-money-laundering requirements. Moynihan did not provide a separate figure detailing the cost of patching alone, leaving the specific allocation for security fixes undisclosed.
Bank of America is among the first major US companies to publicly reveal the number of staff assigned to fixing vulnerabilities found by AI. The decision follows the release of Anthropic's Mythos model in April, which was distributed to select partners via Project Glasswing. The model reportedly identified thousands of serious security vulnerabilities.
Why it matters
The disclosure highlights the growing operational impact of AI-driven vulnerability discovery on large enterprises. Anthropic's Mythos model found thousands of serious security issues, prompting significant resource allocation. OpenAI subsequently launched its Daybreak cybersecurity programme in May, further intensifying industry attention on AI-found flaws.
Critics initially dismissed warnings from AI labs as public relations efforts. However, the conversation has shifted following security incidents such as the Hugging Face hack. Independent evaluations have also confirmed that newer AI models possess stronger capabilities in identifying security weaknesses, validating the urgency of the response.
What happens next
- Monitor official vendor channels for specific vulnerability disclosures related to AI-found flaws.
- Review current patching workflows to ensure they can handle high volumes of incoming security advisories.
- Assess internal capacity to manage remediation efforts without disrupting critical business operations.
- Prepare for potential increases in security tooling and staffing costs as AI discovery becomes standard.
Patch priority
Security teams usually prioritise systems exposed to external networks when addressing AI-discovered vulnerabilities. It is essential to verify whether affected applications are internet-facing or contain sensitive data. Organisations should test patches in isolated environments before deployment to prevent service disruptions. Backing up configurations allows for rapid recovery if updates cause instability. If no fix is available, teams often restrict access to vulnerable services while monitoring for exploitation attempts.
What to do and how to stay safe: Bank of America
- Audit inventory to identify systems running software versions affected by AI-discovered vulnerabilities.
- Implement strict access controls to limit exposure of vulnerable applications to untrusted networks.
- Monitor logs for unusual activity that may indicate exploitation of known weaknesses.
- Coordinate with vendors to obtain timely information on available mitigations or updates.
Step-by-step guide: Patch Management: Definition, Purpose and Operational Reality
General security guidance from the AppSec Scoop newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How many people is Bank of America using to fix AI-found vulnerabilities?
The bank has assigned 4,000 people, including 1,000 outside contractors and 3,000 internal employees.
What AI model was used to discover these vulnerabilities?
Anthropic's Mythos model, released in April to select partners, identified thousands of serious security flaws.
How much did Bank of America spend on this work in the third quarter?
The bank spent a few hundred million dollars combined on software work and anti-money-laundering requirements.
